JP7843686B2 - Systems and methods for controlling the motion of spacecraft in a multi-body celestial system - Google Patents

Description

This disclosure relates, in general, to the control of spacecraft motion, and more specifically, to systems and methods for controlling spacecraft motion in a multi-body celestial system while avoiding unauthorized entry into keepaway regions during normal and abnormal spacecraft operation.

A spacecraft rendezvous is a series of orbital maneuvers in which, during its execution, two spacecraft—a chaser spacecraft and a target or space station—arrive in the same orbit and approach each other at close range (e.g., within visual contact). A spacecraft rendezvous requires precise matching of the orbital velocities and position vectors of the two spacecraft, allowing them to remain within a certain distance through orbital station holding. A spacecraft rendezvous may or may not be followed by docking or patrolling, that is, a procedure that brings the spacecraft into physical contact and forms a link between them. Furthermore, the same spacecraft rendezvous may be used for spacecraft "landing" on natural objects in the presence of a weak gravitational field, such as landing on an asteroid or one of Mars' moons. Spacecraft landings on natural objects may also involve the same orbital velocity matching and are followed by a "descent" that shares similarities with docking.

However, spacecraft rendezvous with targets is a challenging task. A critical criterion for spacecraft rendezvous is maintaining safety, specifically the ability to avoid a collision between the chaser spacecraft and the target in the event of a partial thruster failure. In the event of a partial thruster failure, the chaser spacecraft may deviate from its nominal approach near the target. If the chaser spacecraft deviates significantly from its nominal approach near the target and its current trajectory is passively unsafe, a predetermined active collision avoidance maneuver (CAM) is activated. However, depending on the approach trajectory and the extent of the partial thruster failure, a CAM may not always be possible.

Furthermore, for spacecraft motion planning, mathematical models are used to predict the trajectory as a specific sequence of thrusters is applied to the Chaser spacecraft over time. However, in reality, the true spacecraft motion may deviate from the trajectory predicted by the mathematical model. Such deviations can occur for a variety of reasons, including operational mismatch, measurement noise, and unmodeled phenomena. Operational mismatch results from poor thruster tuning and limitations of the hardware onboard the Chaser spacecraft. Measurement noise can result from sensor detection limits, which provide inaccurate information about the state of the Chaser spacecraft, including its position and velocity. Also, for the computational and interpretability of the mathematical model, it is common practice to exclude complex phenomena that may have a slight impact on the trajectory.

Therefore, improved methods are needed to control the operation of the Chaser spacecraft for safe rendezvous in the event of malfunction, operational mismatch, measurement noise, and other uncertainties.

The objective of some embodiments is to provide systems and methods for controlling the motion of a spacecraft in a multi-body celestial system while avoiding unauthorized entry into a keepaway zone during normal and abnormal operation of the spacecraft. As used herein, normal operation includes moving toward a target within a keepaway zone, and abnormal operation includes one or a combination of failure to receive permission to enter a keepaway zone and/or failure of at least one component of the spacecraft. This problem arises from the requirements of spacecraft motion and rendezvous of multiple spacecraft forming a multi-body celestial system, in order to ensure greater safety in space collaboration. For this purpose, the objective of one embodiment is, upon detecting abnormal operation, to control the motion of the spacecraft toward a keepaway zone such that the likelihood of moving the spacecraft while avoiding the keepaway zone is increased.

Some embodiments are based on the recognition that there exists a spacecraft state close to the keepaway zone that could inevitably lead the spacecraft into the keepaway zone, even if access permission is denied for any reason, including complete or partial failure of the spacecraft's propulsion. As used herein, the spacecraft state includes the spacecraft's position and at least one or a combination of its velocity and acceleration. Furthermore, internal and external forces acting on the spacecraft during its motion, such as inertia and gravity, can change the spacecraft state to a specific state that could lead the spacecraft into the keepaway zone, despite any efforts the spacecraft may make.

Some embodiments are based on the recognition that this problem can be addressed by using a control-invariant set of values for the spacecraft's state in which it should be. As used herein, the control-invariant set is determined such that, when the spacecraft's state is within the control-invariant set, there exist control commands generated by control laws that maintain the spacecraft's state within the control-invariant set, despite internal and external forces acting on the spacecraft. Thus, when the spacecraft is within the control-invariant set, there exist control laws within specified control limits that prevent the spacecraft from entering the keepaway zone.

Since control invariants depend on control limits, some embodiments determine multiple control invariants that form a union of multiple control invariants of values for the spacecraft's state. The union of multiple control invariants may partially enclose the keepaway zone. In some other embodiments, the union of multiple control invariants may completely enclose the keepaway zone. Furthermore, to control the spacecraft's motion in the event of abnormal operation, each control invariant is determined such that an abnormal control law exists that safely aborts the spacecraft's motion, taking into account the operating limits associated with the abnormality.

Some embodiments are based on the recognition that calculating the control invariant set online, i.e., during real-time control of the spacecraft, is computationally expensive. To mitigate this problem, the control invariant set and the corresponding abort control laws are determined offline, i.e., in advance. Specifically, the abort control laws are determined jointly and interdependently with respect to the corresponding control invariant set in order to generate abort control commands. The control invariant set and the corresponding abort laws determined offline may be stored in the controller used to control the motion of the spacecraft.

To this end, during online control of a spacecraft experiencing abnormal operation, the controller receives the spacecraft's current state. Furthermore, the processor selects a set of control invariants that includes the spacecraft's current state. The controller then executes abort control laws corresponding to the selected set of control invariants. Therefore, in different states where abnormal operation is detected, the controller may use different predetermined abort control laws, thereby reducing the computational load and the latency of the response when abnormal operation is detected.

Some embodiments are based on the recognition that spacecraft motion is affected by unbounded probabilistic uncertainty. Unbounded probabilistic uncertainty includes a probabilistic distribution of process noise. Process noise can define operational mismatches and/or unmodeled dynamics of spacecraft motion. In addition to process noise, unbounded probabilistic uncertainty may include a probabilistic distribution of measurement noise in the estimation of the spacecraft state. Because spacecraft motion is affected by unbounded probabilistic uncertainty, it is necessary to consider this uncertainty and avoid unauthorized entry of the spacecraft into the keepaway zone at a given safety likelihood.

Some embodiments are based on the understanding that it is possible to control the motion of a spacecraft with a given safety likelihood. For example, different methods for implementing motion under unbounded probabilistic uncertainty include opportunity constraints, particle filtering, scenario optimization, and probabilistic tube methods. For this purpose, it may be assumed that the motion of a spacecraft can be controlled with a given safety likelihood within the union of multiple control invariant sets. However, such an assumption is based on the concept that each control invariant set is determined deterministically, i.e., without unbounded probabilistic uncertainty. However, such an assumption can be inaccurate because if there is some uncertainty in the motion of the spacecraft during online control, the same or similar uncertainty exists in the computation of the control invariant sets.

To this end, some embodiments are based on the understanding that, in order to guarantee control invariance under unbounded probabilistic uncertainty, each control invariant set should internally approximate the values of the spacecraft's state. Furthermore, such a guarantee should be accompanied by a likelihood of unbounded probabilistic uncertainty that is greater than a given safety likelihood. This is because the final probabilistic guarantee of motion control is a function of the product of the likelihood of control invariance under unbounded probabilistic uncertainty and the likelihood of motion satisfying the constraints derived from the control invariant sets. Due to unbounded probabilistic uncertainty, all of these likelihoods are less than 1 and therefore must be considered together to guarantee a given safety likelihood.

Therefore, each control invariant set internally approximates the value of the spacecraft's state, guaranteeing control invariance if the first likelihood of unbounded probabilistic uncertainty is greater than a predetermined safety likelihood. The control laws are constructed to generate control commands that maintain the spacecraft's state within the union of control invariant sets with a second likelihood, where the second likelihood is selected such that the product of the first and second likelihoods is greater than or equal to a predetermined safety likelihood.

Several embodiments use various techniques to compute a set of control invariants for the dynamics of a spacecraft under unbounded probabilistic uncertainty. For example, one embodiment uses a probabilistically reachable set to determine the set of control invariants. This embodiment is advantageous when the set of control invariants to remain within is convex, but may be suboptimal when the uncertainty has a probability density with thick tails. When the uncertainty has a probability density with thick tails, the estimated range of uncertainty for the computation of the set of control invariants becomes larger, leading to a significant decrease in the amount of the calculated set of control invariants. Since the set of control invariants restricts the states allowed for normal operation, it is desirable to have a large set of control invariants. With respect to the problem in question, the uncertainty is Gaussian uncertainty, and therefore has thin tails.

Additionally or alternatively, the controlled invariant set can be computed by leveraging the robust uncontrolled invariant set. The robust uncontrolled invariant set determines the set of states that can maintain safety despite bounded, unprobabilistic uncertainty. Various computational algorithms can be used to compute the robust uncontrolled invariant set. However, these algorithms are not directly applicable to problems involving the presence of unbounded probabilistic uncertainty, such as those involving the probabilistic distribution of process and/or measurement noise. This is because the computational algorithms are applicable to problems involving bounded, deterministic uncertainty.

To mitigate this problem, unbounded probabilistic uncertainty is transformed into a finite deterministic uncertainty with a predefined likelihood that specifies a range of values. For this purpose, a robust uncontrolled invariant set can be computed using a computational algorithm. Furthermore, the controlled invariant set can be determined based on the computed robust uncontrolled invariant set.

Therefore, one embodiment discloses a controller for controlling the motion of a spacecraft in a multi-body celestial system while avoiding unauthorized entry into a keepaway zone during normal and abnormal operation of the spacecraft, where normal operation includes moving toward the keepaway zone, and abnormal operation includes one or a combination of failure to receive permission to enter the keepaway zone and failure of at least one component of the spacecraft. The controller comprises at least one processor and a memory storing instructions, which, when executed by at least one processor, cause the controller to execute nominal control laws that, during normal operation of the spacecraft, are constrained to maintain the state of the spacecraft within a union of multiple control invariant sets of spacecraft state values that partially or completely enclose a keepaway zone, where the state of the spacecraft includes the position of the spacecraft and at least one or a combination of the velocity and acceleration of the spacecraft, each of the multiple control invariant sets being constrained to maintain the state of the spacecraft within the control invariant set despite internal and external forces acting on the spacecraft when the state of the spacecraft is within the control invariant set. The system is determined such that there exist control commands generated by nominal control laws, and the instructions, when executed by at least one processor, cause the controller to detect abnormal behavior of the spacecraft and execute abort control laws associated with a set of control invariants containing the current state of the spacecraft. At least several different abort control laws are associated with at least several different sets of control invariants, and the abort control laws are determined jointly and interdependently to generate abort control commands for the corresponding sets of control invariants, moving the spacecraft while avoiding the keepaway zone for any state within the corresponding set of control invariants.

Therefore, another embodiment discloses a tracking method for controlling the motion of a spacecraft in a multi-body celestial system while avoiding unauthorized entry into a keepaway zone during normal and abnormal operation of the spacecraft, where normal operation includes moving toward a keepaway zone, and abnormal operation includes one or a combination of failure to receive permission to enter a keepaway zone and failure of at least one component of the spacecraft. The method includes, during normal operation of the spacecraft, executing a nominal control law that is constrained to maintain the state of the spacecraft within a union of multiple control invariant sets of spacecraft state values that partially or completely enclose a keepaway zone, where the state of the spacecraft includes the position of the spacecraft and at least one or a combination of the spacecraft's velocity and acceleration. Each of the multiple control invariant sets is determined such that there exists a control command generated by the nominal control law that maintains the state of the spacecraft within the control invariant set despite internal and external forces acting on the spacecraft when the state of the spacecraft is within the control invariant set. The method further includes, upon detecting abnormal behavior of the spacecraft, executing abort control laws associated with a set of control invariants containing the current state of the spacecraft, wherein at least several different abort control laws are associated with at least several different sets of control invariants, and the abort control laws are determined collaboratively and interdependently to generate abort control commands for the corresponding sets of control invariants, causing the spacecraft to move while avoiding the keepaway zone for any state within the corresponding set of control invariants.

Therefore, yet another embodiment discloses a non-temporary computer-readable storage medium embodying a processor-executable program for performing a method for controlling the motion of a spacecraft in a multi-body celestial system, while avoiding unauthorized entry into a keepaway zone during normal and abnormal operation of the spacecraft, wherein normal operation includes moving toward a keepaway zone, and abnormal operation includes one or a combination of failing to receive permission to enter a keepaway zone and failure of at least one component of the spacecraft. This method involves, during normal operation of a spacecraft, executing nominal control laws constrained by maintaining the spacecraft's state within a union of multiple sets of spacecraft state values that partially or completely enclose a keepaway zone, wherein the spacecraft state includes the spacecraft's position and at least one or a combination of its velocity and acceleration, and each of the multiple sets of control invariants is determined such that, when the spacecraft state is within the set of control invariants, there exists a control command generated by the nominal control law that maintains the spacecraft state within the set of control invariants despite internal and external forces acting on the spacecraft. The method further involves, upon detecting abnormal operation of the spacecraft, executing abort control laws associated with the set of control invariants containing the spacecraft's current state, wherein at least several different abort control laws are associated with at least several different sets of control invariants, and the abort control laws are determined jointly and interdependently to generate abort control commands for the corresponding sets of control invariants that move the spacecraft while avoiding the keepaway zone for any state within the corresponding set of control invariants.

The embodiments disclosed herein will be further described with reference to the attached drawings. The drawings shown are not necessarily to scale, and instead, the emphasis is generally on illustrating the principles of the embodiments of this disclosure.

This invention illustrates the motion of a spacecraft in a multi-body celestial system according to one embodiment of this disclosure. A block diagram of a controller for controlling the motion of a spacecraft during normal and abnormal operation, according to one embodiment of the present disclosure, is shown. An embodiment of this disclosure shows the union of multiple control-invariant sets of values for the state of a spacecraft. A block diagram of a spacecraft including a controller and other components according to one embodiment of the present disclosure is shown. A keepaway set and its complement are shown according to one embodiment of the present disclosure. A probabilistically reachable set is shown according to one embodiment of this disclosure. An internal approximation of a probabilistically reachable set is shown according to one embodiment of this disclosure. Examples of two-dimensional projections of controllable invariant sets and controllable invariant subsets according to certain embodiments of this disclosure are shown. A schematic diagram is shown for determining a controllable invariant set by utilizing a robust controllable invariant set, according to one embodiment of the present disclosure. A flowchart of a method for calculating an internal approximation of a probabilistically reachable set based on a robust, uncontrollable, invariant set, according to one embodiment of the present disclosure, is shown. The complement of a keepaway set, decomposed as a union of convex sets, according to one embodiment of the present disclosure. The following is a collective representation of a convex halfspace that together defines the complement of a keepaway set, according to one embodiment of the present disclosure. The following is a collective representation of a convex halfspace that together defines the complement of a keepaway set, according to one embodiment of the present disclosure. The following is a collective representation of a convex halfspace that together defines the complement of a keepaway set, according to one embodiment of the present disclosure. The following is a collective representation of a convex halfspace that together defines the complement of a keepaway set, according to one embodiment of the present disclosure. A block diagram is shown for reformulating an opportunity constraint according to one embodiment of the present disclosure, which requires that future nominal orbital states remain outside the keepaway set. A block diagram is shown for reformulating an opportunity constraint, according to one embodiment of the present disclosure, which requires that future measurements of a spacecraft remain within a control-invariant set. This diagram shows a block diagram of a method for controlling the motion of a spacecraft while avoiding unauthorized entry into the keepaway zone during normal and abnormal operation of the spacecraft. This is a schematic diagram showing some of the components used to implement the method and system disclosed herein. This is a schematic diagram illustrating, by non-limiting examples, a computing device for implementing the method and system of this disclosure.

Detailed Description: The following description includes numerous specific details for illustrative purposes to facilitate a full understanding of the disclosure. However, it will be apparent to those skilled in the art that the disclosure may be implemented without these specific details. In other examples, the apparatus and methods are shown only in block diagram form to avoid obscuring the disclosure.

Where used herein and in the claims, the words “for example,” “as an example,” “etc.,” and the verbs “equip,” “have,” and “include,” and their other verb forms, when used with a list of one or more components or other items, should each be interpreted as open-ended, meaning that the list should not be considered to exclude any other additional components or items. The phrase “based on” means based at least partially. Furthermore, it should be understood that the expressions and terms used herein are for illustrative purposes only and should not be considered limiting. Any headings used within this description are for convenience only and have no legal or limiting effect.

Figure 1A shows the motion of a spacecraft 101 in a multi-body celestial system according to one embodiment of the present disclosure. The spacecraft 101 may be configured to rendezvous with a target 103 by following an orbit 105. The target 103 may be a spacecraft, a celestial body, the International Space Station, or orbital debris. For illustrative purposes, target 103 is shown as the International Space Station. A keepaway zone 107 exists around target 103. The keepaway zone 107 refers to an area that the spacecraft 101 must not enter without permission. Additionally or alternatively, the keepaway zone 107 corresponds to a keepaway set, which is a collection of conditions including the spacecraft position and velocity that the spacecraft 101 must remain outside of.

The objective of some embodiments is to control the motion of the spacecraft 101 while avoiding unauthorized entry into the keepaway zone 107 during normal and abnormal operation of the spacecraft 101. As used herein, normal operation includes the spacecraft 101 moving toward the keepaway zone 107. Abnormal operation includes failure to receive permission to enter the keepaway zone 107 and failure of at least one component of the spacecraft 101, such as a thruster, or a combination thereof.

To achieve such control objectives, some embodiments provide controllers for controlling the motion of the spacecraft 101 during normal and abnormal operation.

Figure 1B shows a block diagram of a controller 109 for controlling the motion of the spacecraft 101 during normal and abnormal operation, according to one embodiment of the present disclosure. The controller 109 includes a processor 111 and memory 113. The processor 111 may be a single-core processor, a multi-core processor, a computing cluster, or any number of other configurations. The memory 113 may include random-access memory (RAM), read-only memory (ROM), flash memory, or any other suitable memory system. Furthermore, in some embodiments, the memory 113 may be implemented using a hard drive, an optical drive, a thumb drive, an array of drives, or any combination thereof.

Some embodiments are based on the recognition that, even if access permission is denied, there are states of the spacecraft 101 near the keepaway zone 107 that could inevitably lead the spacecraft 101 into the keepaway zone 107, making it difficult to achieve the aforementioned control objective (i.e., controlling the motion of the spacecraft 101 while avoiding unauthorized entry into the keepaway zone 107 during normal and abnormal operation of the spacecraft 101). Access permission may be denied for any reason, including a total or partial failure of the spacecraft 101's propulsion. As used herein, the state of the spacecraft 101 includes the position of the spacecraft 101 and at least one or a combination of the spacecraft 101's velocity and acceleration. In addition, internal and external forces acting on the spacecraft 101 during its motion, such as inertia and gravity, may change the state of the spacecraft 101 to a specific state that could lead it into the keepaway zone 107, regardless of any efforts the spacecraft 101 may make.

Some embodiments are based on the understanding that this problem can be addressed by calculating the union of multiple control-invariant sets of state values for spacecraft 101, within which the state of spacecraft 101 should be maintained.

Figure 1C shows the union of multiple control invariant sets of state values for the spacecraft 101 according to one embodiment of the present disclosure. Control invariant sets 115, 117, 119, and 121 form the union of multiple control invariant sets. In some embodiments, the union of multiple control invariant sets may partially enclose the keepaway zone 107. In some other embodiments, the union of multiple control invariant sets may completely enclose the keepaway zone 107, allowing the spacecraft 101 to approach the target 103. Each control invariant set is determined such that, when the state of the spacecraft 101 is within a certain control invariant set (e.g., control invariant set 121), there exists a control command generated by a nominal control law that maintains the state of the spacecraft 101 within that control invariant set (control invariant set 121), despite internal and external forces acting on the spacecraft 101.

Therefore, during normal operation of the spacecraft 101, when the state of the spacecraft 101 is within the range of any of the control invariant sets 115, 117, 119, and 121, the state of the spacecraft 101 is controlled so that it remains within the range of any of the control invariant sets 115, 117, 119, and 121 and does not enter the keepaway zone 107.

Furthermore, in order to control the motion of the spacecraft 101 in the event of abnormal operation, each control invariant set is determined such that there exists an abort control law that generates an abort control command. The abort control command safely aborts the motion of the spacecraft 101 while avoiding the keepaway zone 107. For example, if the state of the spacecraft is within control invariant set 121 and there is a thruster failure (abnormal operation), the abort law corresponding to control invariant set 121 generates an abort control command that safely aborts the motion of the spacecraft 101 while avoiding the keepaway zone 107.

Some embodiments are based on the recognition that calculating the control invariant sets 115, 117, 119, and 121 online, i.e., during real-time control of the spacecraft 101, is computationally expensive. To mitigate this problem, the control invariant sets 115, 117, 119, and 121 and their corresponding abort control laws are determined offline, i.e., in advance. Specifically, the abort control laws are determined collaboratively and interdependently to generate abort control commands for the corresponding control invariant sets. The control invariant sets and corresponding abort laws determined offline may be stored in the memory 113 of the controller 109.

To this end, during online control of the spacecraft 101 while it is malfunctioning, the processor 111 receives the current state of the spacecraft 101. Furthermore, the processor 111 selects a set of control invariants that includes the current state of the spacecraft 101. The processor 111 then executes the abort control law corresponding to the selected set of control invariants. Therefore, in different states where malfunction is detected, the controller 109 may use different predetermined abort control laws, thereby reducing the computational load and the latency of the response when malfunction is detected.

According to one embodiment, the controller 109 may be embedded in the spacecraft 101. Figure 2 shows a block diagram of the spacecraft 101, including the controller 109 and other components, according to one embodiment of the present disclosure. The spacecraft 101 includes the controller 109, a set of thrusters 201, a set of sensors 203, and a circuit 205. The processor 111 may submit a sequence of control commands, i.e., control commands and abort control commands, generated by nominal and abort control laws to the set of thrusters 201. The set of thrusters 201 is configured to change the state of the spacecraft 101 according to the sequence of control commands generated by nominal and abort control laws. According to one embodiment, the set of thrusters 201 includes eight thrusters, each thruster mounted in a manner aligned with the center of mass of the spacecraft 101, so that the thrusters generate forces that change the position of the spacecraft 101 without generating torque that rotates the spacecraft 101.

The sensor set 203 is configured to generate measurements indicating the state of the spacecraft 101. These measurements are submitted to the processor 111. In one embodiment, the sensor set 203 may include a velocity sensor configured to generate measurements indicating the velocity of the spacecraft 101 and an accelerometer configured to generate measurements indicating the acceleration of the spacecraft 101. The circuit 205 is configured to detect abnormal operation of the spacecraft 101. In one embodiment, the circuit 205 may detect abnormal operation based on the off state of the thruster set 201. For example, one or more thrusters in the thruster set 201 may be turned off due to a failure in the spacecraft 101. Based on the off state of one or more thrusters, the circuit 205 detects abnormal operation and communicates it to the processor 111.

Some embodiments are based on the understanding that the motion of spacecraft 101 is affected by unbounded probabilistic uncertainty. Unbounded probabilistic uncertainty includes a probabilistic distribution of process noise. Process noise may define operational mismatches and/or unmodeled dynamics of the spacecraft 101's motion. In addition to process noise, unbounded probabilistic uncertainty may include a probabilistic distribution of measurement noise in the estimation of the spacecraft's state. Because the motion of spacecraft 101 is affected by unbounded probabilistic uncertainty, it is necessary to consider this uncertainty and, with a given safety likelihood, prevent the spacecraft 101 from illegally entering the keepaway zone 107.

Some embodiments are based on the understanding that it is possible to control the motion of spacecraft 101 with a predetermined safety likelihood. For example, different methods for implementing motion under unbounded probabilistic uncertainty include opportunity constraints, particle filtering, scenario optimization, and probabilistic tube methods. To this end, it may be assumed that the motion of spacecraft 101 can be controlled with a predetermined safety likelihood within the union of multiple control invariant sets. However, such an assumption is based on the concept that each control invariant set is determined deterministically, i.e., without unbounded probabilistic uncertainty. However, such an assumption can be inaccurate because if there is some uncertainty in the motion of spacecraft 101 during online control of spacecraft 101, the same or similar uncertainty exists in the calculation of the control invariant sets.

Therefore, some embodiments are based on the understanding that, in order to guarantee control invariance under unbounded probabilistic uncertainty, each control invariant set should internally approximate the state values of spacecraft 101. Furthermore, such a guarantee should be accompanied by a likelihood of unbounded probabilistic uncertainty that is greater than a given safety likelihood. This is because the final probabilistic guarantee of motion control is a function of the product of the likelihood of control invariance under unbounded probabilistic uncertainty and the likelihood of motion satisfying the constraints derived from the control invariant sets. Due to unbounded probabilistic uncertainty, all of these likelihoods are less than 1 and therefore must be considered together to guarantee a given safety likelihood.

Therefore, each control invariant set internally approximates the state of spacecraft 101, guaranteeing control invariance in the state where the first likelihood of unbounded probabilistic uncertainty is greater than a predetermined safety likelihood. The nominal control law is constructed to generate control commands that maintain the state of spacecraft 101 with a second likelihood within the union of control invariant sets, and the second likelihood is selected such that the product of the first and second likelihoods is greater than or equal to a predetermined safety likelihood.

The control problem described above can be expressed mathematically as follows:

According to one embodiment, the nominal control law steers the spacecraft 101 to target 103 in the keepaway set, while ensuring that the spacecraft 101 remains within the control-invariant set and that all necessary state and input constraints are satisfied by the nominal control law. An example of such a control law solves the following optimization problem at each time step.

Constraint (1b) results in a collection of linear equality constraints describing the expansion of the mean and covariance matrices of the spacecraft's states and measurements. Some embodiments are based on the understanding that, due to the linearity of the spacecraft's dynamics and the Gaussian nature of the operational and measurement uncertainties, the future states and measurements of spacecraft 101 can be described as Gaussian random vectors, along with an explicit description of their mean and covariance.

Several embodiments employ various techniques to compute the set of control invariants for the dynamics of spacecraft 101 under unbounded probabilistic uncertainty (i.e., Gaussian uncertainty). For example, one embodiment uses a probabilistically reachable set to determine the set of control invariants. This embodiment is advantageous when the set of control invariants to remain within is convex, but may be suboptimal when the uncertainty has a probability density with thick tails. When the uncertainty has a probability density with thick tails, the estimated range of uncertainty for the computation of the set of control invariants becomes larger, leading to a significant decrease in the amount of the calculated set of control invariants. Since the set of control invariants restricts the states allowed for normal operation, it is desirable to have a large set of control invariants. With respect to the problem in question, the uncertainty is Gaussian uncertainty, and therefore has thin tails.

Each probabilistically reachable set used to determine the control-invariant set internally approximates the state values of spacecraft 101 to guarantee control invariance. In one embodiment, the internal approximation of the probabilistically reachable set is obtained as the union of probabilistically reachable sets defined for each convex component of the complement of the keep-out set. The internal approximation of the probabilistically reachable set is described below with reference to Figures 3A, 3B, and 3C.

Figure 3A shows a keepaway set 301 and its complement 303 according to an embodiment of the present disclosure.

Figure 3B shows a probabilistically reachable set 305 according to one embodiment of the present disclosure. The probabilistically reachable set 305 includes all states in which the controller 109 can safely keep the spacecraft 101 (i.e., keep the spacecraft 101 outside the keepaway set 301) up to a specified likelihood, despite unbounded probabilistic uncertainty. For the initial state 307, orbits 311, 313, and 315 may be probabilistic future state orbits. For the initial state 309, orbits 317, 319, and 321 may be probabilistic future state orbits. Orbits 311, 313, and 321 are not safe because the spacecraft 101 needs to remain outside the keepaway set 301, but orbits 315, 317, and 319 are safe. In other words, the controller 109 can safely maintain spacecraft 101 starting from initial state 309 with a likelihood of 2/3, and safely maintain spacecraft 101 starting from initial state 307 with a likelihood of 1/3. As a result, set 305 (shown by the horizontal pattern filling) is a probabilistically reachable set corresponding to a safety likelihood of 2/3. Therefore, the probabilistically reachable set 305 includes initial state 309 but does not include initial state 307.

Figure 3C shows an internal approximation of a probabilistically reachable set according to one embodiment of the present disclosure. Set 323 (shown by vertical pattern filling) is an internal approximation of the probabilistically reachable set 305 (shown by horizontal pattern filling). Every state in set 323 is also in probabilistically reachable set 305. From Figure 3C, it can be seen that neither set 323 nor probabilistically reachable set 305 covers the entire complement of keepaway set 301 (shown in gray without pattern filling).

According to one embodiment, the internal approximation of a probabilistically reachable set may correspond to a control-invariant subset. For any state of spacecraft 101 within the control-invariant subset, there exists a control command that maintains the state of spacecraft 101 within the control-invariant subset for known or acceptable future states of the nominal orbit. An exemplary control-invariant subset is described below with reference to Figure 4.

Figure 4 shows an example of a two-dimensional projection 400 of a control invariant set 403 corresponding to a constraint set 401 according to one embodiment of the present disclosure. In one embodiment, the constraint set 401 may be a multidimensional polytope determined by a hyperplane represented by linear inequalities along multiple dimensions corresponding to constraints on the motion of the spacecraft 101. The constraint set 401 may encode safe states of the spacecraft 101. For any state of the spacecraft 101 in the control invariant subset 403, there exists a control command that maintains the state of the spacecraft 101 in the control invariant subset 403 for known or acceptable future states of the nominal orbit. For example, for any state of the spacecraft 101, such as state 415, in the control invariant subset 403 and among all possible control inputs 417-423 that the controller 109 can execute, there exists at least one control command 423 that maintains the state of the spacecraft 101 in the control invariant subset 403. On the other hand, while state 405 may be achievable for a single iteration, all control commands 407-413 that the controller 109 is allowed to take during the next iteration can take the state of the spacecraft 101 outside the constraint set 401.

Some embodiments are based on the understanding that a controlled invariant set can be computed by utilizing a robust uncontrolled invariant set. The robust uncontrolled invariant set determines the set of states that can maintain safety despite bounded, non-probabilistic uncertainty.

Figure 5 shows a schematic diagram 500 for determining a controllable invariant set by utilizing a robust uncontrollable invariant set, according to one embodiment of the present disclosure. Various computational algorithms can be used to compute the robust uncontrollable invariant set. However, these algorithms are not directly applicable to problems involving the presence of unbounded probabilistic uncertainty 402, including the probabilistic distribution of process and/or measurement noise. This is because the computational algorithms are applicable to problems involving bounded deterministic uncertainty.

Figure 6A shows a block diagram of a method 600 for calculating an internal approximation of a probabilistically reachable set based on a robust, controllable, invariant set, according to one embodiment of the present disclosure. In block 601, the method 600 includes decomposing the complement of a keepaway set (for example, the complement 303 of the keepaway set 301, as shown in Figure 3A) as a union of convex sets.

Figure 6B shows the complement of the keepaway set 301, decomposed as a union of convex sets, according to one embodiment of the present disclosure. The convex sets 607-621 form a union of convex sets. Specifically, the keepaway set 301 is a polytope, and its complement can be represented as a union of halfspaces. Each of these halfspaces is convex.

Figures 6C to 6F collectively show the convex halfspaces that define the complement of the keepaway set 301. Sets 623, 627, 631, and 635 are copies of the keepaway set 301. Set 625 contains sets 607, 609, and 611, and set 629 contains sets 611, 613, and 615. Set 633 contains sets 615, 617, and 619, and set 637 contains sets 619, 621, and 607. The convex sets 607-621 are called the keepaway complement components.

In block 605, method 600 further includes the step of computing the union of robust controlled invariant sets to obtain one internal approximation of a probabilistically reachable set for each exponent i of the complement of the keepaway set. The internal approximation guarantees controllability with a first likelihood of unbounded probabilistic uncertainty over a horizon of M time steps. In other words, in the event of abnormal behavior, there exists an abort control law that allows steering spacecraft 101 away from the keepaway set with a first likelihood over M time steps into the future.

In one embodiment, the robust control invariant set and the corresponding abort control law are determined jointly and interdependently using a single calculation of the robust control invariant set. The calculation of the robust control invariant set automatically generates, for each state, a set of control actions that maintain the spacecraft 101 within the robust control invariant set. The set of control actions is characterized by the spacecraft dynamics, control constraints, and the robust control set. Therefore, the abort control law involves selecting a control action from the set of control actions at each time step.

Furthermore, the nominal control law applied during normal operation steers the spacecraft 101 to target 103 in the keepaway set, while ensuring that the spacecraft 101 remains within the control-invariant set and that all necessary state and input constraints are satisfied by the nominal control law. An example of such a nominal control law solves the optimization problem given by equation (1). In one embodiment, the nominal control law is designed using a model predictive controller (MPC). The MPC is based on iterative finite-horizon optimization of a model of the spacecraft 101's dynamics, a set of objectives for the spacecraft 101's motion, and constraints on the spacecraft propulsion system and motion. The MPC can predict future events to take appropriate control actions. According to an embodiment, the MPC may estimate a sequence of control steps across the predicted horizon acting on the spacecraft 101 under the influence of internal and external forces.

Some embodiments are based on the recognition that implementing opportunity constraints (1c) and (1d) can be cumbersome. Therefore, some embodiments aim to provide conservative but manageable implementations of opportunity constraints (1c) and (1d). Some embodiments are based on the recognition that, in order to conservatively implement opportunity constraints (1c) and (1d), they can be reformatted as a collection of mixed-integer linear constraints that conservatively implement opportunity constraints (1c) and (1d). In some embodiments, opportunity constraints (1c) and (1d) can be reformatted as a collection of mixed-integer linear constraints based on Boolean inequalities, quantile reformatting, and disjunctive programming. The reformattings of opportunity constraints (1c) and (1d) are described below with reference to Figures 7A and 7B, respectively.

In block 703, a probabilistic joint chance constraint is obtained by encoding the desired behavior. The probabilistic joint chance constraint may be given as follows:

Stochastic coupling opportunity constraints limit the probability of undesirable behavior to a small probability.
In block 705, the individual opportunity constraints for arbitrary choices are obtained by utilizing simple probability theory and the quantile reformulation of Gaussian opportunity constraints. The individual opportunity constraints for arbitrary choices may be given as follows:

In block 707, mixed-integer linear constraints are obtained based on constraint reinforcement and tangent programming. The mixed-integer linear constraints may be given as follows:

Figure 7B shows a block diagram for reformulating the opportunity constraint (1d) requiring that future measurements of the spacecraft 101 remain within a controllable set, according to one embodiment of the present disclosure. In block 709, the desired behavior of future measurements of the spacecraft 101 to remain within the controllable set is given as a deterministic inequality constraint for all t, as follows:

In block 711, a probabilistic coupling opportunity constraint is obtained by encoding the desired behavior. The probabilistic coupling opportunity constraint may be given as follows:

In Block 713, individual opportunity constraints for arbitrary choices can be obtained by utilizing simple probability theory and the quantile reformulation of Gaussian opportunity constraints. These individual opportunity constraints may be given as follows:

In block 715, the mixed-integer linear constraints are obtained based on constraint reinforcement and tangent programming. The mixed-integer linear constraints may be given as follows:

The use of mixed-integer linear constraints (4) and (5) in optimization problem (1) gives optimization problem (1) a mixed-integer program due to the presence of binary variables. In the case of a real-time implementation, the feasible values for the binary variables may be pre-assigned to obtain a convex quadratic program.

Figure 8 shows a block diagram of method 800 for controlling the motion of spacecraft 101 while avoiding unauthorized entry into the keepaway zone 107 during normal and abnormal operation of spacecraft 101.

In block 801, method 800 includes receiving the current state of spacecraft 101. In block 803, method 800 includes selecting a control-invariant set containing the current state of spacecraft 101.

In block 805, the method includes determining whether an abnormal operation has been detected. If an abnormal operation is detected, in block 807, method 800 includes executing an abort control law associated with a selected set of control invariants. The abort control law generates an abort control command that moves the spacecraft 101 while avoiding the keepaway zone 107.

If no abnormal operation is detected, in block 809, method 800 includes executing nominal control laws. The nominal control laws generate control commands that maintain the state of the spacecraft 101 within a control-invariant set, despite internal and external forces acting on the spacecraft 101.

Figure 9 is a schematic diagram showing some components used to implement the methods and systems of this disclosure. For example, the computer 900 may be adapted to control the motion of the spacecraft 101 in a multi-body celestial system while avoiding unauthorized entry into the keepaway zone 107 during normal and abnormal operation of the spacecraft 101. The CPU or processor 901 may be connected to the memory 905, input/output device 907, and communication interface 909 via the bus system 903. The bus system 903 may also be connected to a storage device 911, control interface 913, display interface 915, and external interface 917.

The external interface 917 can be connected to the extended memory 919, vehicle parameters 921 (i.e., spacecraft specifications, thruster specifications, size, weight, etc.), initial orbit data 923 (i.e., parameters including time, date, altitude, inclination, eccentricity, etc.), target orbit data 925, and other orbit data 927 (i.e., unique orbit data). The bus system 903 can also connect to the control interface 929, the output interface 931, the receiver 933, and the transmitter 935. Furthermore, the bus system 903 can connect the GPS receiver module 937 to the GPS 939. The computer 900 includes an orbit maintenance module 941. The orbit maintenance module 941 may output thruster commands 943. The orbit maintenance module 941 includes a transition orbit generation unit 945, a feedback gain module 947, a feedback controller 949, and a thruster command generation unit 951.

The computer 900 may be a server or a desktop, laptop, mobile, or other computer device or system having one or more processors 901. The processor 901 may be a central processing unit adapted to access code in the form of a transition path generation unit 945 within the memory 905 or storage device 911 (or within extended memory 919) of the computer 900. Depending on the aspects relating to the systems and methods of this disclosure, external storage devices may be contemplated, as further required depending on the specific design of the intended hardware and purpose implementation. For example, the computer 900 may be used to implement steps of the systems and methods in which the memory 905 and/or storage device 911 can store data.

The data stored in memory 905 may include executable module data, vehicle data, and historical spatial data. For example, vehicle data may include the specifications, dimensions, weight, and performance data under varying conditions, including gravity, as well as other perturbations, i.e., the complex motion of a mass body subject to forces other than the gravitational pull of a single other mass body in space.

Furthermore, vehicle data may include data relating to aspects of vehicle dynamics associated with one or more of the following multivariables: (1) anomalous orbital characteristics of a celestial body, i.e., natural objects located outside the Earth's atmosphere, such as the Moon, Sun, asteroids, planets, or stars; (2) anomalous orbital motion of a celestial body; (3) anomalous near-orbits of a celestial body around another celestial body; and (4) other known perturbations. Spatial data may include data relating to celestial bodies, past missions to celestial bodies, and any other data relating to the planning of orbital designs for space, spacecraft, and other celestial bodies in space. For example, spatial data may include data about a celestial body's moon, such as characteristics of the celestial body that can be considered when developing orbital designs from an initial celestial body orbit to a similar target celestial body orbit.

The processor 901 of computer 900 may consist of two or more processors, depending on the specific application. For example, some steps may require separate processors to ensure a specific processing time or speed associated with the system and method of this disclosure. The receiver 933 or input interface may receive spatial data, which may be the most recent spatial data acquired from either the Earth Mission Control Center, sensors associated with the spacecraft, or any other location, after stored historical spatial data stored in memory 905. The receiver 933 and transmitter 935 may provide a radio location for receiving data and transmitting it, for example, to the Earth Mission Control Center or any other destination. A GPS receiver module 937 connected to GPS 939 can be used in aspects related to navigation. Computer 900 may further include external devices, control interfaces, displays, sensors, machines, etc., intended for use in the system and method of this disclosure.

Figure 10 is a schematic diagram illustrating, by non-limiting examples, a computing device for carrying out the method and system of the present disclosure. The computing device 1000 may include a power supply 1001, a processor 1003, a memory 1005, and a storage device 1007, all connected to bus 1009. Furthermore, a high-speed interface 1011, a low-speed interface 1013, a high-speed expansion port 1015, and a low-speed connection port 1017 may be connected to bus 1009. In addition, a low-speed expansion port 1019 is connected to bus 1009. Furthermore, an input interface 1021 may be connected to an external receiver 1023 and an output interface 1025 via bus 1009. Receiver 1027 may be connected to an external transmitter 1029 and a transmitter 1031 via bus 1009. Also, an external memory 1033, an external sensor 1035, a machine 1037, and an environment 1039 may be connected to bus 1009. Furthermore, one or more external input/output devices 1041 can be connected to bus 1009. The network interface controller (NIC) 1043 can be adapted to connect to network 1045 via bus 1009, and data or other data can be rendered, among other things, on a third-party display device, a third-party imaging device, and/or a third-party printing device outside of the computing device 1000.

Memory 1005 can store instructions executable by the computing device 1000, historical data, and any data available by the methods and systems of this disclosure. Memory 1005 may include random access memory (RAM), read-only memory (ROM), flash memory, or any other suitable memory system. Memory 1005 may be a volatile memory unit and/or a non-volatile memory unit. Memory 1005 may also be another form of computer-readable medium, such as a magnetic disk or an optical disk.

The storage device 1007 may be adapted to store supplemental data and/or software modules used by the computing device 1000. For example, the storage device 1007 may store historical data and other related data as described above in relation to this disclosure. In addition, or alternatively, the storage device 1007 may store historical data such as the data referred to above in relation to this disclosure. The storage device 1007 may include a hard drive, an optical drive, a thumb drive, an array of drives, or any combination thereof. Furthermore, the storage device 1007 may include an array of devices including computer-readable media such as floppy disk devices, hard disk devices, optical disk devices, or tape devices, flash memory or other similar solid memory devices, or devices in a storage area network or other configuration. Instructions may be stored in the information carrier. When an instruction is executed by one or more processing units (e.g., processor 1003), it performs one or more methods, such as those described above.

The computing device 1000 can optionally be linked via bus 1009 to a display interface or user interface (HMI) 1047 adapted to connect the computing device 1000 to a display device 1049 and a keyboard 1051. The display device 1049 may, among other things, include a computer monitor, camera, television, projector, or mobile device. In some implementations, the computing device 1000 may also include a printer interface for connecting to a printing device, which may, among other things, include a liquid inkjet printer, solid ink printer, large-scale commercial printer, thermal printer, UV printer, or dye sublimation printer.

The high-speed interface 1011 manages bandwidth-intensive operations for the computing device 1000, and the low-speed interface 1013 manages less bandwidth-intensive operations. Such function assignments are merely examples. In some implementations, the high-speed interface 1011 may be coupled to memory 1005, a user interface (HMI) 1047, a keyboard 1051 and a display 1049 (e.g., via a graphics processor or accelerator), and a high-speed expansion port 1015 that can accept various expansion cards via bus 1009. In some implementations, the low-speed interface 1013 is coupled to storage device 1007 and the low-speed expansion port 1017 via bus 1009. The low-speed expansion port 1017, which may include various communication ports (e.g., USB, Bluetooth®, Ethernet®, Wireless Ethernet®), may be coupled to one or more input/output devices 1041. The computing device 1000 may be connected to a server 1053 and a rack server 1055. The computing device 1000 may be implemented in several different forms. For example, the computing device 1000 may be implemented as part of a rack server 1055.

The following description provides only exemplary embodiments and is not intended to limit the scope, applicability, or configuration of this disclosure. Rather, the following description of exemplary embodiments provides a practicable description for realizing one or more exemplary embodiments for those skilled in the art. The intent is to describe various modifications that may be made to the function and configuration of the elements without departing from the spirit and scope of the subject matter disclosed as described in the claims.

The following description provides specific details for a complete understanding of the embodiments. However, it will be understood by those skilled in the art that embodiments may be carried out without these specific details. For example, systems, processes, and other elements in the disclosed subject matter may be shown as components in the form of block diagrams so as not to obscure the embodiments with unnecessary details. In other examples, well-known processes, structures, and techniques may be shown without unnecessary details to avoid obscuring the embodiments. Furthermore, similar reference numbers and names in different drawings refer to similar elements.

Furthermore, individual embodiments may be described as processes represented as flowcharts, flow diagrams, data flow diagrams, structural diagrams, or block diagrams. While flowcharts can describe operations as sequential processes, many operations can be performed in parallel or simultaneously. In addition, the order of operations may be reordered. A process may terminate when its operations are complete, but it may have additional steps not discussed or included in the diagrams. Furthermore, not all operations in any particular process described may occur in all embodiments. A process may correspond to a method, function, procedure, subroutine, subprogram, etc. When a process corresponds to a function, the termination of the function may correspond to the function's return to the calling function or the main function.

Furthermore, embodiments of the disclosed subject matter may be implemented at least partially manually or automatically. Manual or automatic implementations may be performed, or at least assisted, through the use of a machine, hardware, software, firmware, middleware, microcode, hardware description language, or any combination thereof. When implemented in software, firmware, middleware, or microcode, the program code or code segments for performing the required tasks may be stored in a machine-readable medium. The required tasks may be performed by a processor.

The various methods or processes outlined herein may be coded as software executable on one or more processors using any one of various operating systems or platforms. In addition, such software may be written using any of several suitable programming languages and/or programming or scripting tools, and may be compiled as executable machine language code or intermediate code that runs on a framework or virtual machine. Typically, the functionality of program modules may be combined or distributed as desired in various embodiments.

Embodiments of this disclosure may be embodied as an example provided. The actions performed as part of the method may be ordered in any preferred manner. Therefore, embodiments may be constructed in which actions are performed in a different order than those exemplified, including the simultaneous performance of several actions shown as sequential actions in the exemplary embodiments.

While this disclosure has been described with reference to certain preferred embodiments, it should be understood that various other adaptations and modifications can be made within the spirit and scope of this disclosure. Therefore, it is the claims aspect to encompass all variations and modifications that fall within the true spirit and scope of this disclosure.

101 Spacecraft, 103 Target, 105 Orbit, 107 Keepaway Zone, 109 Controller, 111 Processor, 113 Memory.

Claims (19)

A controller for controlling the motion of a spacecraft in a multi-body celestial system, while avoiding unauthorized entry into a keepaway zone during normal and abnormal operation of the spacecraft, wherein normal operation includes moving toward a target in the keepaway zone, and abnormal operation includes one or a combination of failure to receive permission to enter the keepaway zone and failure of at least one component of the spacecraft, wherein the controller comprises at least one processor and a memory storing instructions, and when an instruction is executed by the at least one processor, the controller,
During the normal operation of the spacecraft, a nominal control law is executed to maintain the state of the spacecraft within a union of multiple control invariant sets of state values of the spacecraft that partially or completely enclose the keepaway zone, wherein the state of the spacecraft includes the position of the spacecraft and at least one or a combination of the velocity and acceleration of the spacecraft, and each of the multiple control invariant sets is determined to execute a control command generated by the nominal control law that maintains the state of the spacecraft within the control invariant set despite internal and external forces acting on the spacecraft when the state of the spacecraft is within the control invariant set, wherein the nominal control law solves an optimization problem at each time step that minimizes the sum of the squared distances of the spacecraft over time to the keepaway zone and the amount of energy consumed by an open-loop control sequence that is subject to linear equality constraints describing the state of the spacecraft and the expansion of the mean and covariance matrix of the measurements, and the instruction, when executed by the at least one processor, further to the controller,
Upon detecting the abnormal operation of the spacecraft, an abort control law associated with a set of control invariants including the current state of the spacecraft is executed, and at least several different abort control laws are associated with at least several different sets of control invariants, and the abort control laws are jointly and interdependently determined to execute abort control commands for the corresponding sets of control invariants, causing the spacecraft to move while avoiding the keepaway zone for any state within the corresponding sets of control invariants .
The aforementioned abort control command is determined offline in advance and stored in memory by the controller . A spacecraft for travel in a multi-body celestial system,
The controller according to claim 1,
A set of thrusters configured to change the state of a spacecraft according to a sequence of control commands generated by the aforementioned nominal control law and the aforementioned abort control law,
A set of sensors configured to generate measurements indicating the state of the spacecraft,
A spacecraft comprising a circuit configured to detect the abnormal operation of the spacecraft. The controller according to claim 1, wherein the motion of the spacecraft is subject to unbounded probabilistic uncertainty, while the unauthorized entry of the spacecraft into the keepaway zone is avoided with a predetermined safety likelihood; each of the control invariant sets internally approximates the value of the state of the spacecraft to guarantee control invariance such that the first likelihood of the unbounded probabilistic uncertainty is greater than the predetermined safety likelihood; the nominal control law is configured to generate control commands that maintain the state of the spacecraft with a second likelihood within the union of the plurality of control invariant sets, and the second likelihood is selected such that the product of the first likelihood and the second likelihood is greater than or equal to the predetermined safety likelihood. The controller according to claim 3, wherein each of the control invariant sets is a probabilistically reachable set determined by the first likelihood of the unbounded probabilistic uncertainty. The controller according to claim 3, wherein each of the control invariant sets is a robust control invariant set determined with respect to the nominal control law, together with the bounded unprobabilistic uncertainty corresponding to the first likelihood on the unbounded probabilistic uncertainty. The controller according to claim 5, wherein the nominal control law is a model predictive control (MPC) using a model of the spacecraft's dynamics with the unbounded probabilistic uncertainty, and the nominal control law, together with other constraints including one or a combination of operating constraints, ensures that the spacecraft remains within the robust controlled invariant set with a second likelihood, and the nominal trajectory approaches the keepaway set without entering it. The controller according to claim 6, wherein the stochastic distribution of process noise specifies one or a combination of the operational mismatch of the spacecraft thrusters and the unmodeled dynamics of the spacecraft's motion. The controller according to claim 6, wherein the unbounded probabilistic uncertainty includes a probabilistic distribution of measurement noise for estimating the state of the spacecraft, and the MPC estimates a sequence of control steps over a predictive horizon acting on the spacecraft, such that the state has bounded measurement noise having a range of values, the range of values being restricted to have a likelihood for the probabilistic distribution of the measurement noise greater than the first likelihood. The controller according to claim 8, wherein the state of the spacecraft is determined by a stochastic filter that is subject to the measurement noise. The controller according to claim 9, wherein the stochastic filter includes one or a combination of a Kalman filter and a particle filter. The controller according to claim 3, wherein the constraints for maintaining the state of the spacecraft within the union of the plurality of control-invariant sets require their satisfaction with the second likelihood. The controller according to claim 11, wherein the constraints include opportunity constraints. The controller according to claim 11, wherein the constraints include one or a combination of opportunity constraints requiring the state of the spacecraft to be outside the keepaway zone, operational constraints, and opportunity constraints requiring the measurement of the spacecraft to be within the plurality of control invariant sets. A method for controlling the motion of a spacecraft in a multi-body celestial system while avoiding unauthorized entry into a keepaway zone during normal and abnormal operation, wherein the normal operation includes moving toward the keepaway zone, and the abnormal operation includes one or a combination of failing to receive permission to enter the keepaway zone and/or failure of at least one component of the spacecraft, and the method is
During the normal operation of the spacecraft, the method includes executing a nominal control law that maintains the state of the spacecraft within a union of multiple control invariant sets of state values of the spacecraft that partially or completely enclose the keepaway zone, wherein the state of the spacecraft includes the position of the spacecraft and at least one or a combination of the velocity and acceleration of the spacecraft, and each of the multiple control invariant sets is determined to execute a control command generated by the nominal control law that maintains the state of the spacecraft within the control invariant set despite internal and external forces acting on the spacecraft, while the state of the spacecraft is within the control invariant set, wherein the nominal control law solves an optimization problem at each time step that minimizes the sum of the squared distances of the spacecraft over time to the keepaway zone and the amount of energy consumed by an open-loop control sequence that is subject to linear equality constraints describing the state of the spacecraft and the expansion of the mean and covariance matrix of the measured values of the spacecraft, and the method further,
Upon detecting the abnormal operation of the spacecraft, the following actions are taken: an abort control law associated with a set of control invariants including the current state of the spacecraft is executed, wherein at least several different abort control laws are associated with at least several different sets of control invariants, and the abort control laws are determined jointly and interdependently to execute abort control commands for the corresponding sets of control invariants, causing the spacecraft to move while avoiding the keepaway zone for any state within the corresponding sets of control invariants .
The abort control command is determined offline in advance and stored in memory . The method according to claim 14, further comprising avoiding unauthorized entry of the spacecraft into the keepaway zone with a predetermined safety likelihood, while the motion of the spacecraft is subject to unbounded probabilistic uncertainty, wherein each of the control invariant sets internally approximates the value of the state of the spacecraft to guarantee control invariance such that the first likelihood of the unbounded probabilistic uncertainty is greater than the predetermined safety likelihood, and the nominal control law is configured to generate a control command that maintains the state of the spacecraft with a second likelihood within the union of the plurality of control invariant sets, wherein the second likelihood is selected such that the product of the first likelihood and the second likelihood is greater than or equal to the predetermined safety likelihood. The method according to claim 15, wherein each of the control-invariant sets is a probabilistically reachable set determined by the first likelihood of the unbounded probabilistic uncertainty regarding possible abnormal behavior. The method according to claim 15, wherein each of the control invariant sets is a robust control invariant set determined with respect to the nominal control law, together with the bounded unprobabilistic uncertainty corresponding to the first likelihood on the unbounded probabilistic uncertainty. The method according to claim 16, wherein the unbounded probabilistic uncertainty includes a probabilistic distribution of process noise. A non-temporary computer-readable storage medium embodying a processor-executable program for performing a method for controlling the motion of a spacecraft in a multi-body celestial system, while avoiding unauthorized entry into a keepaway zone during normal and abnormal operation, wherein the normal operation includes moving toward the keepaway zone, and the abnormal operation includes one or a combination of failing to receive permission to enter the keepaway zone and failure of at least one component of the spacecraft, and the method is
During the normal operation of the spacecraft, the method includes executing a nominal control law that maintains the state of the spacecraft within a union of multiple control invariant sets of state values of the spacecraft that partially or completely enclose the keepaway zone, wherein the state of the spacecraft includes the position of the spacecraft and at least one or a combination of the velocity and acceleration of the spacecraft, and each of the multiple control invariant sets is determined to execute a control command generated by the nominal control law that maintains the state of the spacecraft within the control invariant set despite internal and external forces acting on the spacecraft, while the state of the spacecraft is within the control invariant set, wherein the nominal control law solves an optimization problem at each time step that minimizes the sum of the squared distances of the spacecraft over time to the keepaway zone and the amount of energy consumed by an open-loop control sequence that is subject to linear equality constraints describing the state of the spacecraft and the expansion of the mean and covariance matrix of the measured values of the spacecraft, and the method further,
Upon detecting the abnormal operation of the spacecraft, the following actions are taken: an abort control law associated with a set of control invariants including the current state of the spacecraft is executed, wherein at least several different abort control laws are associated with at least several different sets of control invariants, and the abort control laws are determined jointly and interdependently to execute abort control commands for the corresponding sets of control invariants, causing the spacecraft to move while avoiding the keepaway zone for any state within the corresponding sets of control invariants .
The abort control command is a non-temporary computer-readable storage medium that is determined offline in advance and stored in memory .